Hijacked By Www.searchathand.com

[Robski]

Hi guys my browser got hijacked by a 'virus' recently which kept redirecting me either to a 404 page or to a website without any function www.searchathand.com. After trawling through the net I found some useful info, the virus has been around since 06, it doesn't seem to have any specific purpose, and it's hard to get rid of. First of all it sporadically redirected me and then it started targetting a specific website I was using and blocked me out of it completely, I found a fix to it on another website;

Apparently something was able to change my TCP/IP settings.

It was set to an IP in Russia.

Go to TCP/IP settings for the connection and it will be set to "use the following server addresses" and in my case there were IP's 85.255.114.22 and 85.255.112.205.

I changed it to assign automatic IP and no longer had problems with the redirect to searchathand.com.

this fixed the problem with it blocking the specific website, although I haven't been able to remove the 'virus' and I'm still getting a lot of redirects, but only to 404 pages. I don't feel comfortable with this 'thing' in my computer and the Kaspersky, AVG anti spyware, Adware SE and Spybot I use have all failed to detect or get rid of it, so any ideas?

[cdnvic]

Go to Control Panel / Network Connections and right-click on your connection and choose properties. Under the general tab, scroll down to TCP/IP settings, highlight it and click the properties button.

It probably is set to "Use this IP address" and will have the IP of that site entered there. Change the setting to "obtain IP address automatically" and it should go back to normal. Then go to http://www.eset.com/onlinescan/ and do a full scan on your system.

Edited October 2, 2007 by cdnvic

[britmaveric]

Run spyware and antivirus under safe mode.

[Guest Reimar]

Go to Control Panel / Network Connections and right-click on your connection and choose properties. Under the general tab, scroll down to TCP/IP settings, highlight it and click the properties button.

It probably is set to "Use this IP address" and will have the IP of that site entered there. Change the setting to "obtain IP address automatically" and it should go back to normal. Then go to http://www.eset.com/onlinescan/ and do a full scan on your system.

If the Link above didn't work, go to http://freedrweb.com/ download the CureIT file and run from your computer a full scan!

[Robski]

Ok thanks cdnvic and reimar, that's the same procedure as I did before and on checking it again the ICP setting is still normal.

Probably a bit of paranoia on my part, am I to assume though that the searchathand program was never actually in my computer,

but only changed the settings from outside and that's why I have been unable to detect it?

Thanks also for the links and I will run those now.